“This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could’ve executed commands and modified the settings of millions of modems, accessed any business customer’s PII, and gained essentially the same permissions of an ISP support team.”
Cox exposed over 700 APIs, and replaying a request a few times was enough to get past authorization. That let an outsider look up any business customer, pull their Wi-Fi password and run commands on their modem. Cox hot-patched it in a day and says nobody abused it. Curry’s own Cox modem was hacked three years earlier by someone else, and nobody knows how.